AWS DynamoDB table Auto Scaling not enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AWS_16
Category - Subcategory	Storage - Replication
Provider	AWS
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	59959d2b-2ea4-4ace-9df3-72076f5eb761

Impact

Checks if DynamoDB tables have autoscaling configuration.

NOTE: The tables with billing_mode = "PAY_PER_REQUEST" such configuration is embedded by default.

How to Fix

Resource: aws_appautoscaling_target, aws_appautoscaling_policy, aws_dynamodb_table [source,go]

resource "aws_dynamodb_table" "pass" { name = "user" hash_key = "user-id" billing_mode = "PROVISIONED" read_capacity = 10 write_capacity = 10 attribute { name = "user-id" type = "S" } }

resource "aws_appautoscaling_target" "pass" { resource_id = "table/${aws_dynamodb_table.pass.name}" scalable_dimension = "dynamodb:table:ReadCapacityUnits" service_namespace = "dynamodb" min_capacity = 1 max_capacity = 15 }

resource "aws_appautoscaling_policy" "pass" { name = "rcu-auto-scaling" service_namespace = aws_appautoscaling_target.pass.service_namespace scalable_dimension = aws_appautoscaling_target.pass.scalable_dimension resource_id = aws_appautoscaling_target.pass.resource_id policy_type = "TargetTrackingScaling"

target_tracking_scaling_policy_configuration { predefined_metric_specification { predefined_metric_type = "RDSReaderAverageCPUUtilization" predefined_metric_type = "DynamoDBReadCapacityUtilization" } } }

// or:

resource "aws_dynamodb_table" "pass_on_demand" { name = "user" hash_key = "user-id" billing_mode = "PAY_PER_REQUEST"

attribute { name = "user-id" type = "S" } }